Computer viruses, worms, trojans, hackers, key recovery attacks, malicious executables, probes, etc. are a menace to users of computers connected to public computer networks (such as the Internet) and/or private networks (such as corporate computer networks). In response to these threats, many computers are protected by antivirus software and firewalls. However, these preventative measures are not always adequate. For example, there have been many instances where worms and other attacks have taken advantage of a known vulnerability in computer software (e.g., in firewall technology) the day after the public became aware of the vulnerability. Because of such a rapid launch, the patch necessary to correct the vulnerability could not be deployed in time to prevent the attack. Similar, most antivirus software relies on updates to that software so that signatures of known viruses can be utilized to recognize threats. In the case of a “zero-day” worm or virus (e.g., a worm or virus that has just been launched), most computer systems are completely vulnerable to attack because no known patch or signature update has yet been made available.
Due to the level of malicious activity on the Internet, organizations are deploying mechanisms for detecting and responding to new attacks or suspicious activity, sometimes referred to as intrusion prevention systems. However, many of these intrusion prevention systems are limited to protecting against already known attacks because they use rule-based intrusion detection systems.
Detection mechanisms, such as honeypots and anomaly detection systems, have been developed for use in more powerful reactive-defense systems. In contrast with intrusion detection systems, honeypots and anomaly detection systems offer the possibility of detecting and responding to previously unknown attacks or “zero-day” attacks. A honeypot is generally defined as a trap that is set to detect or deflect attempts at unauthorized use of information systems. However, it should be noted that honeypots do not see legitimate traffic or activity. One reason for this is because honeypots are often placed at a network location that legitimate traffic would have no reason to access. Another reason is that honeypots are usually too slow to process traffic in the time required for real world applications. Yet another reason is that honeypots do not have the capabilities to fully service the legitimate traffic because, for example, honeypots do not fully share state with the actual system. Anomaly detection systems protect a resource by monitoring attempted accesses to it and using heuristics to classify the accesses as normal or anomalous. Honeypots and anomaly detection systems offer different tradeoffs between accuracy and the scope of attacks that can be detected.
Honeypots can be heavily instrumented to accurately detect attacks, but they depend on an attacker attempting to exploit a vulnerability against them. This makes honeypots good for detecting scanning worms, but ineffective against manually directed attacks or topological and hit-list worms. Furthermore, honeypots are typically used only for server-type applications.
Anomaly detection systems can theoretically detect both types of attacks, but are usually much less accurate than honeypots. Most anomaly detection systems offer a tradeoff between false positive and false negative detection rates. For example, it is often possible to tune the system to detect more potential attacks, however, this is at an increased risk of misclassifying legitimate traffic. While it is possible to make an anomaly detection system more insensitive to attacks, this creates the risk of missing some actual attacks. Because anomaly detection systems can adversely affect legitimate traffic by, for example, dropping legitimate requests, system designers often tune the system for low false positive rates which may misclassify attacks as legitimate traffic.
Accordingly, it is desirable to provide systems and methods that overcome these and other deficiencies of the prior art.